BYOK means your account, your model choice
A BYOK coding agent connects to a provider account you control rather than reselling one bundled model plan. You choose the provider, model ID, account limits, and billing relationship; the agent client supplies the workspace workflow.
That is useful when different models fit different jobs. You may prefer one provider for tool-heavy agent tasks, another for a specialized model, and a local server for private work.
Use a named provider profile
Do not overwrite one global key whenever you switch models. Create a named profile for each provider account, record the endpoint and model ID, and keep the credential in the client’s secure storage or in an environment variable outside the repository.
Truss lets you choose a provider profile rather than turning model choice into a permanent app-wide decision. This makes it easier to test a new model without losing a working configuration.
- Enter the provider endpoint and exact model ID.
- Save or set the key outside the workspace.
- Use Test connection before relying on the profile for an agent run.
- Keep a local profile as a fallback when appropriate.
Read failures as provider signals
A 401 generally means the provider rejected the credential. A 402 can mean billing or credits are required. A rate-limit response means the key is recognized but temporarily unable to serve the request. A model-not-found response usually means the model ID or provider route is wrong.
Those errors are not interchangeable. Test the connection with the exact profile, confirm the provider account has access to the selected model, and use the provider’s own dashboard for account or credit status.
Keep the key separate from source code
Treat a provider key like any other credential. Do not paste it into a prompt, commit it to `.env` without ignoring that file, or include it in a workspace setting you plan to share. Rotate a key immediately if it appears in a public issue, screenshot, or commit.
The right outcome is a portable project and private credentials: anyone can clone the workspace, while each developer selects their own account profile.
Next steps
Put it to work in your own workspace.
Pick the surface that fits your day, then connect a model you control.
FAQ
Questions developers ask before switching.
Do I need credits to use a paid BYOK model?
Usually yes. A valid key can still receive a billing, credit, or rate-limit response if the account cannot use that model at that time.
Can I switch back to a local model after using BYOK?
Yes. Provider selection is separate from the workspace and client surface, so you can choose a local profile for the next run.